From Newsgroup: sci.crypt

## In this issue
1. [2025/252] Chiplet-Based Techniques for Scalable and Memory- ...
2. [2025/1661] Distinguishing Goppa codes using higher-order vanishing
3. [2026/917] Obscura: Privacy-Preserving Protocol for the ...
4. [2026/1319] A Real-World Law-Enforcement Hack: The Case of ...
5. [2026/1320] Differentially Private Intermediate Result Resizing ...
6. [2026/1321] Signing It Twice: Mitigating the Effects of State ...
7. [2026/1322] Reliable Homomorphic Matching for Fuzzy Labeled PSI ...
8. [2026/1323] miniMEDS - Short GMW Signatures from Isometry Hints
9. [2026/1324] Efficient Parallelization of Large-Scale Modular ...
10. [2026/1325] The Generalised Tate Pairing over any field
11. [2026/1326] LaMS: A p-adic Layered Modulus Switching for ...
12. [2026/1327] Fault assisted Man-In-The-Middle Attack on MAYO
13. [2026/1328] Shorter Hash-based Signatures via Bucket Thinning
14. [2026/1329] Flock: Fast Proving for Batch Boolean Computations
15. [2026/1330] Real-world Qualification Proof: A Protocol for ...
16. [2026/1331] The Most Efficient Protocol for PAKE: What Exact ...
17. [2026/1332] A Differentiated Approach for Post-Quantum DNSSEC
18. [2026/1333] Apples, Oranges, and Signatures: Pitfalls and ...
19. [2026/1334] Principles for pRHL Proofs of Cryptographic ...
20. [2026/1335] Falafel: Modular Zero-Knowledge Proofs of Training ...
21. [2026/1336] RotPIR: Sublinear Single-Server PIR with Efficient ...
22. [2026/1337] Elliptic Extraction and Pushable Hints for Higher- ...
23. [2026/1338] Bitslicing the AEGIS
24. [2026/1339] Key recovery for the McEliece cryptosystem using ...
25. [2026/1340] Generalized Batched Decomposition Key-Switching for ...
26. [2026/1341] A Modular Risk Assessment Module for Adaptive ...
27. [2026/1342] Accountable Anonymous Cross-Chain Atomic Swaps via ...
28. [2026/1343] BiSON: Billion-Scale Oblivious Nearest-Neighbor ...
29. [2026/1344] Public Coefficient Matters: A Practical ...
30. [2026/1345] Double-Structured Genetic Algorithm for Solving the ...
31. [2026/1346] Almost Scriptless Adaptor Signatures from any ...
32. [2026/1347] Revisiting the Quantum Indifferentiability of ...
33. [2026/1348] On Canonical Liftings, Group Actions, and ...
34. [2026/1349] Sharper and Closed-Form Attacks on $\mathsf{SIS}$ ...
35. [2026/1350] Refined Evaluation Methods of Decryption Failure ...
36. [2026/1351] Hardware Private Cubic Circuits
37. [2026/1352] Dead ManrCOs Switch Cryptography
38. [2026/1353] 3PaaS: Privacy-Preserving Post-Compromise Security ...
39. [2026/1354] Adaptive Quantum-Resistant Hybrid Encryption ...
40. [2026/1355] Compressing Correlations via Secret Replication: ...
41. [2026/1356] Spain: Succinct proofs for numerical computations
## 2025/252
* Title: Chiplet-Based Techniques for Scalable and Memory-Aware Multi-Scalar Multiplication
* Authors: Florian Hirner, Florian Krieger, Sujoy Sinha Roy
* [Permalink](https://eprint.iacr.org/2025/252)
* [Download](https://eprint.iacr.org/2025/252.pdf)
### Abstract
This paper presents a high-performance architecture for accelerating Multi-Scalar Multiplication (MSM) on ASIC platforms, targeting cryptographic applications with high throughput and scalability demands. Current MSM accelerators on FPGA and ASIC platforms typically focus on designing efficient processing elements (PEs) to perform resource-intensive elliptic curve point operations, which require a high number of 384-bit modular multipliers. Our approach diverges from existing works by adopting a chiplet-based design, which optimally balances area, power consumption, and computational throughput. By analyzing memory requirements across window sizes, we determine an optimal mixed configuration of 12- and 13-bit windows, which allows efficient integration of multiple PEs per chiplet. Considering the single-PE case, our design achieves a 1.37x speedup and a 1.3x area reduction over prior works. Moreover, our multi-PE chiplet design outperforms monolithic designs by 2.2x in area-time product while allowing lower production costs and higher yield.
## 2025/1661
* Title: Distinguishing Goppa codes using higher-order vanishing
* Authors: Tobias Hemmert, Andreas Wiemers
* [Permalink](https://eprint.iacr.org/2025/1661)
* [Download](https://eprint.iacr.org/2025/1661.pdf)
### Abstract
We present a new algorithm to distinguish alternant and Goppa codes from general linear codes. Our approach is based on higher-order vanishing of polynomials and can be applied to a wide set of code parameters. It also applies to Goppa code parameters used in the Classic McEliece key encapsulation mechanism. While these parameters are out of reach in practice, we analyse the behaviour of our distinguisher and estimate its complexity for them, indicating that it is more efficient than previous distinguishing approaches. This is supported by concrete experiments that distinguish codes with larger parameters in practice.
## 2026/917
* Title: Obscura: Privacy-Preserving Protocol for the Algorand Blockchain Using LSAG Ring Signatures
* Authors: Navid Azimi
* [Permalink](https://eprint.iacr.org/2026/917)
* [Download](https://eprint.iacr.org/2026/917.pdf)
### Abstract
While public blockchains provide transparent and auditable transaction histories, they inherently compromise user privacy. Existing privacy-enhancing protocols, such as those deployed on Ethereum, typically rely on succinct zero-knowledge proofs (zk-SNARKs) to obscure the transaction graph. However, implementing comparable cryptographic guarantees on high-throughput blockchains like Algorand is challenging due to strict per-call execution budgets and the state contention introduced by global Merkle accumulators. This paper presents Obscura, a decentralized, non-custodial privacy protocol tailored for constrained smart contract environments. Obscura achieves transaction anonymity using Linkable Spontaneous Anonymous Group (LSAG) signatures over the BN254 elliptic curve, verified entirely on-chain. To overcome limitations of the Algorand Virtual Machine (AVM), we introduce a novel state model that leverages Algorand's Box Storage for $O(1)$ commitment membership checks, eliminating the need for global Merkle accumulators, and a dynamic opcode-budget expansion mechanism via pooled inner application calls. Our implementation demonstrates that signer-ambiguous privacy is practical and efficient on Algorand without relying on trusted setups or succinct proofs. Obscura provides a robust privacy layer for transparent ledgers, bridging the gap between high-throughput blockchain architectures and the dual requirements of cryptographic privacy and selective auditability.
## 2026/1319
* Title: A Real-World Law-Enforcement Hack: The Case of Encrochat
* Authors: Martin R. Albrecht, Sunoo Park, Michael A. Specter, Douglas Stebila * [Permalink](https://eprint.iacr.org/2026/1319)
* [Download](https://eprint.iacr.org/2026/1319.pdf)
### Abstract
In 2020, a coordinated law-enforcement effort infiltrated Encrochat, an end-to-end encrypted service provider, exfiltrating historical and real-time data and metadata over months. Encrochat was used extensively by organised crime, and the data from the operation was used as supporting evidence in over 6,000 arrests and related prosecutions across Europe. Encrochat's architecture was vertically integrated, with the company acting as both a device vendor and service provider; Encrochat sold modified Android smartphones with its own PKI and custom applications, including encrypted messaging based on the Signal protocol. In this work, we give the most detailed public account to date of Encrochat's infrastructure and how it was compromised.
## 2026/1320
* Title: Differentially Private Intermediate Result Resizing for Scalable Secure Multi-Party Analytics
* Authors: Long Gu, Gowri R Chandran, Shaza Zeitouni, Thomas Schneider, Zsolt Istv|in
* [Permalink](https://eprint.iacr.org/2026/1320)
* [Download](https://eprint.iacr.org/2026/1320.pdf)
### Abstract
Secure Multi-Party Computation (MPC) enables collaborative analytics without exposing raw data. Yet, complex data retrieval operations in relational databases (i.e., relational queries) remain limited by scalability bottlenecks: oblivious operators must pad intermediate results to worst-case sizes to prevent information leakage, thereby inflating communication and computation costs. We propose Resizer, a lightweight operator that can be inserted transparently into relational query plans to bound intermediate result sizes while preserving rigorous privacy guarantees. Resizer reduces intermediate results from fully-oblivious to noisy size bounds that satisfy differential privacy (DP). We propose two Resizer variants, shuffle-based and sort-based, and provide a formal analysis of the privacy guarantees and security in the semi-honest model. We evaluate the Resizer variants in the ORQ framework under semi-honest and honest-majority assumptions using TPC-H benchmark queries, demonstrating that Resizer incurs negligible overhead while reducing data volume. In both LAN and WAN settings, complex queries achieve speedups compared with state-of-the-art oblivious baselines, confirming that Resizer reduces the padding bottleneck and enables scalable, privacy-preserving relational analytics.
## 2026/1321
* Title: Signing It Twice: Mitigating the Effects of State Reuse for Stateful Signatures
* Authors: Niels Duif, Daan S. Meijer
* [Permalink](https://eprint.iacr.org/2026/1321)
* [Download](https://eprint.iacr.org/2026/1321.pdf)
### Abstract
Stateful hash-based signature schemes like LMS and XMSS are built on the Winternitz one-time signature. The effect of state reuse for these schemes has been shown to be disastrous [1][2]. This paper shows that the signer can mitigate this effect if a state is reused only once. This is achieved by repeating the randomized hashing step until a hash value with specific properties is found. Our results show that at least 80 bits of security can be achieved in 99% of the key reuses, an improvement of 49 bits. This requires the signer to repeat the randomized hashing step 1.4 million times on average. Slightly lower security can be reached with much less hashing.
## 2026/1322
* Title: Reliable Homomorphic Matching for Fuzzy Labeled PSI at Scale
* Authors: Erkam Uzun
* [Permalink](https://eprint.iacr.org/2026/1322)
* [Download](https://eprint.iacr.org/2026/1322.pdf)
### Abstract
Fuzzy Labeled Private Set Intersection (FLPSI) lets a receiver learn the labels of enrolled records that are similar to its query, and nothing else. FLPSI can be built in several ways. Constructions based on a set-threshold reduction reach practical performance: a query matches a record when the two agree on a threshold number of components. These constructions delegate the private matching to an inner set-threshold kernel. We study its homomorphic form, which combines leveled-BFV homomorphic encryption (HE), a garbled circuit, and secret sharing to decide the match under encryption and release the record's label. We identify a composition gap in this kernel, an instance of a protocol-level problem: efficiency is bought with a per-trial false-accept probability, but one query runs a trial for every record, so the error compounds with the database size into the kernel's realization soundness error (RSE), the rate at which it accepts a query the plaintext matcher would reject. The RSE is a reliability property of the cryptographic matching layer, not the matcher's accuracy. On a spurious accept the kernel also returns a value the plaintext matcher would never produce. A sound kernel must contribute zero or negligible RSE of its own. We formalize this requirement as a composable security property, give a closed-form bound on the receiver's advantage, and close the gap with CSTPSI, a kernel that runs independent token rounds and raises the per-trial bound to a matching power. We prove CSTPSI secure in the semi-honest model. The closed-form bound sets the round count: two token rounds suffice for million-scale databases and three for billion-scale at the $10^{-6}$ engineering threshold. Our evaluation confirms the prediction. At a million records the baseline kernel's RSE reaches $100\%$ while CSTPSI holds it at $0$ in every measured configuration. CSTPSI decouples threshold-checking and upload costs from label size. For large labels at small to moderate scale it is more than $20\times$ faster than the baseline kernel, with up to $93\%$ less communication. It converges to the baseline only at the million-scale database size. Our implementation, with a one-command reproducibility harness, is publicly available.
## 2026/1323
* Title: miniMEDS - Short GMW Signatures from Isometry Hints
* Authors: Dinand Blom, Giuseppe Lamorgese, Ruben Niederhagen, Lars Ran, Simona Samardjiska
* [Permalink](https://eprint.iacr.org/2026/1323)
* [Download](https://eprint.iacr.org/2026/1323.pdf)
### Abstract
Hints are a concept from side-channel analysis referring to small
amounts of information that enable an adversary, via a potentially very efficient procedure, to extract the secret. We take this cryptanalytic concept
and give it a constructive make-over.
We formalize a short $\Sigma$-protocol based on the famous Goldreich, Micali, Wigderson protocol, in which the responses are not of the full witness size, but are only small hints. The hints can be used to extract the full response. We show that under our formalization, these protocols preserve the security properties of $\Sigma$-protocols.
We instantiate a practical protocol using a group action from tensor isomorphism and an efficient extracting procedure borrowed from an attack by Narayanan et al. on the MEDS signature scheme. We derive a signature scheme, called miniMEDS, which demonstrates practically the benefits of our hint-based construction, allowing for 22%-24% reduction in signature size compared to the latest updated parameters of MEDS.
## 2026/1324
* Title: Efficient Parallelization of Large-Scale Modular Multiplication via Low-Latency LogJumps
* Authors: Selim K-#rb-#y-#k, Maciej Czuprynko, Florian Krieger, Florian Hirner, Sujoy Sinha Roy
* [Permalink](https://eprint.iacr.org/2026/1324)
* [Download](https://eprint.iacr.org/2026/1324.pdf)
### Abstract
Elliptic-Curve Cryptography (ECC) found in Zero-Knowledge Proofs (ZKPs) protects assets worth more than a billion dollars on privacy-preserving blockchain networks. There, the transaction rate is mostly limited by the computational cost of Multi-Scalar Multiplications (MSMs). Thus, hardware acceleration of these operations, for instance, using FPGAs, is of interest. Current accelerators leverage the Pippenger algorithm to compute the MSMs. Due to data dependencies, the algorithmrCOs performance is affected by the latency of the internal modular multipliers. Typically, these multiplications are realized using Montgomery multipliers. A promising variant of this algorithm is LogJumps, which offers potential for parallelism and lower latency. This is achieved by reducing data dependencies within the Montgomery reduction. Yet, prior work has neither formalized nor explored a low-latency, hardware-friendly parallel realization of this method. We address this gap by formalizing parallelism in LogJumps and presenting the first practical, truly parallel LogJumps architecture for the BLS12-377 prime. Our modular multiplication design achieves up to 56% lower latency than the lowest-latency multiplier in the ZPRIZE 2022, while maintaining a 250 MHz frequency and throughput. Furthermore, we reduce the MSM latency by up to 1.85|u using a full-point adder pipeline, while our logic consumption increases by only 1.32|u.
## 2026/1325
* Title: The Generalised Tate Pairing over any field
* Authors: Jonathan Komada Eriksen
* [Permalink](https://eprint.iacr.org/2026/1325)
* [Download](https://eprint.iacr.org/2026/1325.pdf)
### Abstract
We generalise a pairing on elliptic curves over finite fields, called the generalised Tate pairing, which is defined in terms of an arbitrary endomorphism of the curve, with certain trace requirements. We rederive this pairing from group cohomology, which allows us to generalise the pairing to principally polarized abelian varieties over any field, endomorphisms of any trace, and prove perfectness using a general duality theorem.
## 2026/1326
* Title: LaMS: A p-adic Layered Modulus Switching for Provable Dual Attacks on LWE
* Authors: Rui-Jie Wang, Zhong-Xiao Wang, Qun-Xiong Zheng, Xuan Zhao
* [Permalink](https://eprint.iacr.org/2026/1326)
* [Download](https://eprint.iacr.org/2026/1326.pdf)
### Abstract
The Learning with Errors (LWE) problem is a central foundation for post-quantum schemes such as Kyber and Dilithium. Dual attacks are among the main tools for assessing the concrete hardness of LWE instances. At EUROCRYPT 2024, Pouly and Shen introduced the first provable dual attack against LWE. Subsequently, at ASIACRYPT 2025, Qu and Xu incorporated modulus switching into this framework by recovering the guessed secret modulo several small primes and recombining the resulting residues via the Chinese Remainder Theorem (CRT). Although this CRT-based strategy substantially reduces the search space of each individual run, it reconstructs the full guessed secret through several distinct primes whose product must exceed \(q\). Consequently, the total guessing cost is dominated by the largest CRT prime \(p_k\). This raises a natural question: can the same recovery effect be achieved by repeatedly applying the subroutine with a fixed small prime, while further reducing the overall complexity?
We answer this question affirmatively by proposing layered modulus switching ($\LaMS$), a provable modulus switching dual attack based on a \(p\)-adic view of the guessed secret. Instead of recovering residues modulo several distinct primes, \LaMS\ fixes a single small prime \(p\) and recovers the guessed secret digit by digit in its \(p\)-adic expansion. After each digit is recovered, its contribution is subtracted from the LWE samples, producing a new target LWE instance in which the next digit becomes the new target modulo \(p\). As a result, the dominant guessing term is reduced from \(O(\nsol p_k^{\nsol})\) in the CRT-based attack to \(O(\lceil \log_p q\rceil \nsol p^{\nsol})\), where \(p < p_k\).
We also correct a parameter issue in previous Kyber estimates. With this correction, \LaMS\ reduces the estimated attack cost by 22/31/41 bits for Kyber-512/768/1024, respectively, relative to the corrected CRT-based attack of Qu and Xu.
## 2026/1327
* Title: Fault assisted Man-In-The-Middle Attack on MAYO
* Authors: Siddhesh Shinde, Sayandeep Saha
* [Permalink](https://eprint.iacr.org/2026/1327)
* [Download](https://eprint.iacr.org/2026/1327.pdf)
### Abstract
Multivariate quadratic (MQ) signature schemes such as MAYO are among the leading candidates for post-quantum digital signatures, with security relying on the hardness of solving systems of multivariate quadratic equations. In this paper, we present a fault-assisted man-in-the-middle attack targeting the key-generation procedure of MAYO. Specifically, we target the computation of the public key, which is represented as a system of $m$ quadratic polynomials. Following the MAYO specification, each polynomial is associated with a matrix representation composed of the components $P_i^{(1)}, P_i^{(2)}$, and $P_i^{(3)}$. Our attack injects a single fault during the computation of the $P_i^{(3)}$ component of the public key, causing the resulting public key to satisfy a simplified linear relation involving the secret oil matrix. From the faulty public key, we derive an overdetermined linear system over $F_{16}$ that enables complete recovery of the secret oil matrix.
Unlike previous fault attacks that primarily target the signing algorithm, our attack targets the key generation procedure to recover the oil secret and exploit the recovered oil secret to reconstruct the legitimate public key corresponding to the victim's secret key i.e correcting the public key. This allows the adversary to transparently participate in the communication as a man-in-the-middle, producing valid signatures on behalf of the victim.
We evaluate the attack on a fault simulated MAYO implementation and demonstrate successful recovery of the oil matrix from a single faulty key-generation execution followed by public key correction.
## 2026/1328
* Title: Shorter Hash-based Signatures via Bucket Thinning
* Authors: Chongxu Ren, Kaiyi Zhang, Hongbo Yu
* [Permalink](https://eprint.iacr.org/2026/1328)
* [Download](https://eprint.iacr.org/2026/1328.pdf)
### Abstract
The stateless hash-based digital signature algorithm SLH-DSA is a standardized post-quantum signature scheme based on the SPHINCS$^+$ framework. Although SLH-DSA has well-studied security properties, its signatures are relatively large. This has motivated continued work on reducing the signature size of stateless hash-based signature schemes. Recent work of Abri and Katz introduced forced pruning for reducing the few-time signature component in SPHINCS$^+$-style schemes. However, the concrete cover bound for PORS+FP remains conservative, which prevents smaller parameter choices from meeting the target security level.
We introduce BPORS+FP, a bucket-thinned variant of PORSFP for the bottom few-time signature layer of SPHINCS$^+$-style schemes. The construction places independent PORS child keys under an outer FORS-like bucketing layer. For each selected child key, the number of previous uses is reduced from the bottom-key use count \(q_0\) to a binomially thinned count \(R\sim\operatorname{Bin}(q_0,2^{-B})\). The SPHINCS$^+$ level cover term is therefore evaluated at a smaller random use count, which creates room for smaller child parameters. BPORS+FP also combines this bucket-thinning effect with a global forced-pruning size threshold.
Our evaluation shows that BPORS+FP gives shorter signatures than PORS+FP in five of the six standard SPHINCS$^+$ parameter rows considered, with the only exception being the 128-bit fast row. For NIST's limited-signature-use SLH-DSA parameter sets, replacing the few-time component by BPORS+FP reduces the total signature size by about 22%--26%, compared with about 10%--14% from PORS+FP.
## 2026/1329
* Title: Flock: Fast Proving for Batch Boolean Computations
* Authors: Benedikt B|+nz, Ron Rothblum, William Wang
* [Permalink](https://eprint.iacr.org/2026/1329)
* [Download](https://eprint.iacr.org/2026/1329.pdf)
### Abstract
For many applications of SNARKs, a key bottleneck is proving large batches of standard cryptographic hash evaluations, such as SHA-256, Keccak, or BLAKE3. We introduce Flock, a hash-based SNARK for extremely fast proving of such batched Boolean computations. Flock proves batches of the same R1CS circuit (plus input/output relations between them), can prove hash-chains and Merkle path openings, and in principle can be extended to full-fledged hash-based signature verification. At its core, Flock combines new optimizations for the lincheck and zerocheck protocols with an aggressively optimized proof-of-concept implementation co-designed by coding agents.
On a single core of an M4 Max processor, Flock proves 82k evaluations of the BLAKE3 compression function, 42k SHA-256 compressions, and 30k Keccak permutations per second rCo less than a $250\times$ overhead over native execution. On ten cores, throughput exceeds 660k BLAKE3 compressions per second; in proving SHA-256, Flock is more than $9\times$ faster than Binius64, the prior state of the art, and more than $500\times$ faster than the fastest elliptic curve-based SNARK we measured against.
## 2026/1330
* Title: Real-world Qualification Proof: A Protocol for Supporting Real-world Assets in DeFi
* Authors: Xiaohan Yue, Haoran Si, Fucai Zhou, Jian Xu, Yong Yu
* [Permalink](https://eprint.iacr.org/2026/1330)
* [Download](https://eprint.iacr.org/2026/1330.pdf)
### Abstract
Integrating Real-World Assets (RWA) into Decentralized Finance (DeFi) enables borrowers to leverage off-chain assets for on-chain transactions. However, this integration faces a critical security challenge: ensuring that private asset data, utilized within cryptographic proofs, is authenticated by and cryptographically bound to a trusted issuer. Existing solutions, such as decentralized identifiers (DIDs) and oracles, fail to simultaneously satisfy the requisite security standards and performance constraints. To address this, we propose Real-world Qualification Proof (RQP), a cryptographic protocol designed for the privacy-preserving verification of off-chain asset qualifications.
RQP introduces a new primitive, Witness-Hiding Authentication (WHA), which operates in conjunction with zk-SNARKs. WHA enables asset issuers to authenticate RWA data, allowing the on-chain smart contract to efficiently verify the binding relationship between the issuer's authentication and the borrower's zero-knowledge proof. The proposed WHA effectively anchors the data privacy guarantee of RQP within the zero-knowledge property of the proof system while ensuring source authenticity. Furthermore, to ensure scalability and minimize on-chain gas costs, we adopt zk-rollup methodologies and employ the Inner Product Argument (specifically MIPP) to aggregate multiple RQP proofs. This yields a protocol that is not only secure and private but also computationally efficient for high-throughput DeFi applications. Experiments show that logarithmic verification efficiency optimization can be achieved in the multi-borrower proof scenario.
## 2026/1331
* Title: The Most Efficient Protocol for PAKE: What Exact Stuff Do You Need to Hash at the End?
* Authors: Jiayu Xu
* [Permalink](https://eprint.iacr.org/2026/1331)
* [Download](https://eprint.iacr.org/2026/1331.pdf)
### Abstract
A Password-Authenticated Key Exchange (PAKE) protocol allows two parties to jointly establish a cryptographic session key, in the "password-only" setting where the only information shared in advance is a low-entropy password. In recent years, the One-encryption EKE with 2-round Feistel cipher (OEKE-2F) protocol, a compiler from Key Encapsulation Mechanism (KEM) to PAKE, has received much attention, for the following reasons: (1) When instantiated with the DiffierCoHellman KEM, it is the most computationally efficient PAKE protocol to date that is secure in the Universal Composability (UC) framework; and (2) When instantiated with a post-quantum KEM, it provides a generic way to construct efficient PAKE protocols based on post-quantum assumptions.
Unfortunately, the community cannot agree upon what the OEKE-2F protocol exactly is: part of the second protocol message is an RO hash of the KEM key, together with any number of the following:
- The password,
- The KEM public key,
- The first protocol message, and
- The KEM ciphertext.
This yields 16 potential variants of OEKE-2F; only two of them have been studied in the literature, and their pros and cons are poorly understood.
In this work, we present a comprehensive analysis of *all 16 variants* of OEKE-2F, proving the UC-security of each of them. The general takeaway is that the "hash everything" version requires the fewest security properties of the underlying KEM scheme, and the more items we remove from the hash, the more security requirements the KEM scheme has to satisfy rCo although all of the additional KEM properties are still mild. We pinpoint the exact KEM properties each version of OEKE-2F needs, and thoroughly explain the rationales.
The significance of this work lies in that it helps the community converge upon the "right" version of OEKE-2F, and perhaps also in that this is the first paper by the author that is over 100 pages.
## 2026/1332
* Title: A Differentiated Approach for Post-Quantum DNSSEC
* Authors: Marc Espie, Hugo Mayer, Ludovic Perret
* [Permalink](https://eprint.iacr.org/2026/1332)
* [Download](https://eprint.iacr.org/2026/1332.pdf)
### Abstract
Post-quantum signature algorithms pose significant challenges for DNSSEC migration: their larger keys and signatures exceed DNS over UDP transport limits, making TCP fallback unavoidable even for the most compact schemes. We propose a differentiated algorithm selection, assigning distinct signature algorithms to the Zone Signing Key (ZSK) and Key Signing Key (KSK) roles. This approach expands the space of deployable post-quantum configurations beyond what undifferentiated selection permits, enabling algorithms that would otherwise be impossible to deploy: UOV, with 128-byte signatures but 43~KB keys, produces DNSKEY responses exceeding the 64~KB DNS limit under undifferentiated constraints, yet becomes viable when paired with a compact-key KSK. We also evaluate hybrid PQ/T schemes through signature concatenation, combining classical P256 with post-quantum algorithms in a single RRSIG record to provide dual security during the transition period.
Using a containerized testbed validated against AFNIC's .fr TLD structure (4.2 million domains), we systematically measure response sizes, resolution latency, TCP fallback rates, and signing performance across 18 configurations. Differentiated configurations achieve 1.28-1.52|u latency overhead relative to classical ECDSA while enabling algorithms that undifferentiated constraints prohibit. Hybrid PQ/T concatenation introduces acceptable overhead (7--19%) for backward-compatible quantum resistance.
## 2026/1333
* Title: Apples, Oranges, and Signatures: Pitfalls and Methodology in ML-DSA Benchmarking
* Authors: Sebastien Riou, Jong-Yeon Park, Liga Anwar, Axel Poschmann, Michael Hutter
* [Permalink](https://eprint.iacr.org/2026/1333)
* [Download](https://eprint.iacr.org/2026/1333.pdf)
### Abstract
Cryptographic migration, particularly in the post-quantum setting, poses significant practical challenges and requires reliable performance data to support sound engineering decisions. For ML-DSA, however, existing benchmarking practices often produce misleading or non-comparable results, complicating migration and cryptographic agility efforts. This paper analyzes common pitfalls in benchmarking ML-DSA signature operations, including subtle inconsistencies when comparing security levels. We show that execution-time variability of the ML-DSA signing algorithm - an inherent property due to rejection sampling and other data-dependent components - makes commonly used straightforward metrics, e.g., min/average/max, unsuitable for migration planning. To address this gap, we propose a robust benchmarking methodology based on standardized input data sets and clearly qualified reporting metrics. The proposed approach enables fair comparison across hardware and software implementations and supports designers of real-time systems to assess the worst-case execution time.
## 2026/1334
* Title: Principles for pRHL Proofs of Cryptographic Protocols: How to Convince EasyCrypt that your Protocol is Secure
* Authors: Manuel Barbosa, Fran|oois Dupressoir, Cameron Low, Charlotte Mylog, Sabine Oechsner, Th|-o Vignon
* [Permalink](https://eprint.iacr.org/2026/1334)
* [Download](https://eprint.iacr.org/2026/1334.pdf)
### Abstract
The EasyCrypt proof assistant has been used to
successfully formalize security proofs for a wide variety of crypto-
graphic primitives. However, attempts at formalizing objects with interactivity, such as protocols, have fared much worse. In this
paper, we investigate (some of) the reasons for this difficulty by
formalizing a simple interactive key agreement protocol. From
a first complete but exploratory proof, to a failed attempt at
a structured proof, and to what we believe is an rCLessentialrCY
proof, we identify which proof features contribute most to the
complexity of formalization in pRHL. In particular, we argue that
difficulties in formalizing the security of interactive protocols in
the computational model arise from the fact that such proofs rely
on both state and temporal invariantsrCothe former to support
cryptographic reasoning, and the latter to support reasoning
about the protocolrCOs structure. We believe that this observation
can help build new reasoning tools that can bridge the gap that
currently exists between primitive-focused tools and protocol-
focused tools.
## 2026/1335
* Title: Falafel: Modular Zero-Knowledge Proofs of Training in the Federated Setting
* Authors: Tariq Bontekoe, Sven Bootsma, Vincent Dunning, Thom Sijpesteijn, Thomas Attema
* [Permalink](https://eprint.iacr.org/2026/1335)
* [Download](https://eprint.iacr.org/2026/1335.pdf)
### Abstract
We introduce Falafel, a modular scheme for Fast, Authenticated, Locally Attested FEderated Learning, with which parties can create a zero-knowledge proof of training (zkPoT) for Federated Learning (FL). The proof guarantees active security during the federated training process as well as publicly verifiable correctness of the final, trained model. All without revealing any additional information about the local datasets or intermediate local model states.
Specifically, our approach targets FL of (deep) neural networks with a centralized server for weight updates. Our zkPoT not only offers attestation for local training steps, but also for the centralized weight update, as well as taking into account input authenticity by introducing a trusted auditor. This way an external verifier can check the entire training process, from dataset to final model.
In contrast to prior work on zkPoTs, our construction solely relies on well-understood cryptographic assumptions and primitives, is highly parallelizable, and takes a modular approach. This modular (commit-and-prove) approach uses several novel core proof components, that could be swapped for other building blocks if desired. We show that, for LeNet, we generate a zkPoT of 70 kB in roughly 150 seconds for a single training round. FalafelrCOs prover time is in line with prior work, and its proof size is significantly smaller (10rCo15|u), without relying on less-understood assumptions or instantiating FiatrCoShamir using arithmetic hash functions.
## 2026/1336
* Title: RotPIR: Sublinear Single-Server PIR with Efficient Pre-Processing via Oblivious Homomorphic Rotation
* Authors: Zhou Zhang, Song Bian, Zhenyu Guan, Giuseppe Persiano
* [Permalink](https://eprint.iacr.org/2026/1336)
* [Download](https://eprint.iacr.org/2026/1336.pdf)
### Abstract
Single-server PIR is a powerful cryptographic primitive that allows a client to retrieve public data from a remote server without revealing which item it accessed. Its privacy guarantee, however, inherently forces the server to do work linear in the database size, which is impractical at a large scale. Client-Preprocessing PIR (CP-PIR)~[Patel et al., CCS 2018] suggests to push linear computation to an offline preprocessing phase, enabling online queries with sublinear server computation and communication. While CP-PIR has since attracted considerable attention, designing an efficient preprocessing phase remains challenging. The original construction, along with much subsequent work~(e.g.,~[Zhou et al., S\&P 2024]), streams the entire database, which incurs linear communication that scales only to moderately sized data. A different approach consists of implementing the preprocessing using Fully Homomorphic Encryption (FHE) (e.g.,~[Corrigan-Gibbs et al., Eurocrypt 2022]), but the current best proposal (ThorPIR [Fisch et al., CCS 2024]) still imposes prohibitively expensive homomorphic computation on the server.
In this paper, we tackle the problem of designing a practical preprocessing phase for CP-PIR. We introduce RotPIR, a novel CP-PIR with a preprocessing that is simultaneously sublinear-communication (i.e., no database streaming) and computation-efficient, while keeping online communication and computation sublinear. RotPIR is obtained by co-designing our PIR protocol with the underlying FHE operations. Specifically, we propose an innovative preprocessing framework with an advanced homomorphic operator, {\em oblivious homomorphic rotation}, which enables the database to be rotated according to an encrypted offset, and significantly accelerates the offline server-side computation. Our experimental results show that RotPIR can achieve up to $1000\times$ speedup in offline server-side computation when compared to the state-of-the-art CP-PIR protocols that do not stream the entire database during the preprocessing.
## 2026/1337
* Title: Elliptic Extraction and Pushable Hints for Higher-Dimensional SQIsign * Authors: Anis Bkakria
* [Permalink](https://eprint.iacr.org/2026/1337)
* [Download](https://eprint.iacr.org/2026/1337.pdf)
### Abstract
Higher-dimensional SQIsign variants use product and Kani-style isogeny representations to make response isogenies compact, checkable, or compatible with non-smooth degrees. These representations raise a foundations question: do they introduce genuinely higher-dimensional hardness, or do they preserve elliptic extraction while moving the additional assumptions into simulation? This paper gives a proof-theoretic separation between these two layers. We identify a recoverability condition under which an accepted higher-dimensional response publicly induces an elliptic Hom element; under the usual challenge-separation hypotheses, special soundness then extracts an elliptic \OneEnd witness. The remaining higher-dimensional assumptions are simulation assumptions, and we formulate them as non-interactive hint distributions.
The separation yields two concrete theorem packages. First, SQIsign2D--West admits an exact Fiat--Shamir-with-hints EUF-CMA theorem: the security loss is expressed through a simulation-hint \OneEnd assumption, the statistical simulator loss, the challenge-space term, and the commitment min-entropy term; a pushable uniform-hint corollary gives the EndRing-compatible interpretation under a named hint-indistinguishability assumption. Second, for SQIPrime2D we do not claim a proof for the published auxiliary sampler. We define and analyze \(\mathsf{SQIPrime2D\text{-}UAux}\), a foundations variant that replaces the published Algorithm-context AIO layer by a context-independent uniform auxiliary hint distribution. UAux is an ideal proof-model distribution unless an efficient represented sampler is separately supplied; an approximate sampler instantiates the theorems with an explicit additive sampling loss.
For this SQIPrime2D-UAux foundations variant, UAux gives a context-independent and exactly pushable replacement for the auxiliary AIO layer. We then introduce challenge-carrying uniform hints that additionally reveal the non-smooth challenge isogeny, the residual response isogeny, and the UAux auxiliary isogeny. These hints are stronger than ordinary SQIPrime auxiliary information, but they are fully pushable through the smooth self-reduction isogenies used in EndRing-style reductions. Consequently SQIPrime2D-UAux admits a fully pushable EndRing-compatible challenge-carrying hint layer, with a q-HintDist assumption separating simulation-shaped hints from the pushable distribution. None of these SQIPrime-side statements is a claim of plain EndRing security or a claim that the published SQIPrime2D AIO sampler itself is pushable.
## 2026/1338
* Title: Bitslicing the AEGIS
* Authors: Frank Denis
* [Permalink](https://eprint.iacr.org/2026/1338)
* [Download](https://eprint.iacr.org/2026/1338.pdf)
### Abstract
The AEGIS family of authenticated encryption algorithms is built on a large state whose update function is a cascade of dependent AES rounds. For bitslicing, this looks like the worst possible case.
Yet the parallelism is already inside a single update: for example, an AEGIS-128L update applies one AES round to all eight state blocks at once, filling an eight-block bitsliced data path by itself.
We describe a sliced representation that keeps the rest of the cipher cheap too and lets AEGIS-128L run $2.5 times$ fewer parallel AES rounds per byte than bitsliced AES-128-CTR.
On ARM, RISC-V, and WebAssembly, the resulting constant-time implementations are faster than side-channel-hardened AES-GCM on every platform measured, the X2 variants by factors of two to six. In pure JavaScript, where bitwise operators are exactly 32 bits wide, the same layout is faster than the widely used pure-JavaScript implementations of AES-GCM and ChaCha20-Poly1305.
## 2026/1339
* Title: Key recovery for the McEliece cryptosystem using higher-order vanishing
* Authors: Tobias Hemmert
* [Permalink](https://eprint.iacr.org/2026/1339)
* [Download](https://eprint.iacr.org/2026/1339.pdf)
### Abstract
We present a new key recovery attack against the McEliece cryptosystem with binary Goppa codes that applies to a wide range of parameter sets. Earlier work already observed that homogeneous polynomials vanishing of higher order at the columns of the parity check matrix of a given code could be used to distinguish binary Goppa codes from random linear codes. This work now exploits the structure of these polynomials for key recovery. We illustrate the effectiveness of our approach by breaking a number of previously unbroken McEliece key recovery challenges published by the Technology Innovation Institute (TII). We conjecture that our approach also applies to Classic McEliece parameter sets and yields a key recovery algorithm with roughly the same complexity as the higher-order vanishing distinguisher. While this complexity is still significantly higher than the targeted security level of Classic McEliece parameter sets, this improves on currently known key recovery attacks.
## 2026/1340
* Title: Generalized Batched Decomposition Key-Switching for CKKS
* Authors: Antonio J. Pe|#a, Zaira Pindado, Hugo Sanz-Gonz|ilez
* [Permalink](https://eprint.iacr.org/2026/1340)
* [Download](https://eprint.iacr.org/2026/1340.pdf)
### Abstract
A basic property of lattice-based homomorphic encryption schemes is that ciphertexts carry an inherent noise that accumulates as computation advances. The key-switching procedure of these schemes allows the homomorphic re-encryption of a ciphertext under a new secret key, but it is a major source of noise growth. Several strategies have been proposed to reduce the amount of noise introduced by key-switching in the CKKS scheme. In this work, we generalize the RNS-based decomposition technique to an arbitrary number of input polynomials and secret keys. Performing multiple relinearizations and rotations in batch enables one to hoist the modulus lowering and decomposition steps of key-switching, respectively, which restricts noise growth and avoids redundant computation. We prove the security and correctness of all the proposed algorithms, and derive explicit noise bounds for them. Practical examples illustrate the impact of these optimizations on applications like private deep neural network inference. In addition, we providerCoto the best of our knowledgerCothe first noise analysis of the double-hoisted BSGS matrix-vector multiplication algorithm of Bossuat et al. 2021, which is a building block of state-of-the-art CKKS bootstrapping circuits. Our analysis additionally reveals an optimization concerning the automorphism applications during its giant steps.
## 2026/1341
* Title: A Modular Risk Assessment Module for Adaptive Cryptographic Selection in Q-OPSEC
* Authors: Darlan Noetzold, Jorge L. V. Barbosa, Juan F. De Paz, Valderi R. Q. Leithardt
* [Permalink](https://eprint.iacr.org/2026/1341)
* [Download](https://eprint.iacr.org/2026/1341.pdf)
### Abstract
This paper presents RiskService, a modular risk assessment module integrated into the Q-OPSEC adaptive AI middleware for quantum cryptography. A synthetic dataset covering 58 features across nine groups, including behavioral, device, network, authentication, and LLM-derived signals, feeds a training pipeline evaluating six model families under class-imbalanced conditions. LightGBM achieves the best performance, with AUC-ROC of 0.9895, average precision of 0.9344, and Brier score of 0.0421 at threshold 0.60, with inference latency of 1.8ms. Deployment benchmarks across three hardware tiers confirm feasibility under constrained resources: quantized XGBoost runs in 54.2ms on the ESP32 with AUC-ROC of 0.9112, enabling a two-tier architecture where edge nodes perform preliminary screening and forward ambiguous events for full-precision regime determination. Calibrated risk scores govern the selection among classical TLS1.3, post-quantum, and hybrid key derivation paths in the Q-OPSEC cryptographic layer.
## 2026/1342
* Title: Accountable Anonymous Cross-Chain Atomic Swaps via Threshold-Openable Linkable Ring Adaptor Signatures
* Authors: Yuanshao Liang, Hui Li
* [Permalink](https://eprint.iacr.org/2026/1342)
* [Download](https://eprint.iacr.org/2026/1342.pdf)
### Abstract
Cross-chain atomic swaps enable decentralized asset exchange across independent ledgers, but their public transcripts may expose transaction flows, signer identities, and business relationships. Existing scriptless swap mechanisms based on adaptor signatures provide witness-coupled execution, yet the signer is public. Linkable ring adaptor signatures further hide the signer within a ring, but they do not support controlled opening when a completed swap becomes disputed. In this paper, we put forward ALRAS, an accountable anonymous cross-chain atomic-swap mechanism based on Pair-Consistent Threshold-Openable Linkable Ring Adaptor Signatures. We design a pair-consistent opening mechanism that binds a ring-adaptor pre-signature, an opening ciphertext, a scoped link tag, and the completed full signature to the same hidden signer. This mechanism prevents false-opening, ciphertext-substitution, and transcript-splicing attacks while requiring a threshold-governed and publicly verifiable opening in the dispute path. We construct a generic compiler from a NIZK-compatible, index-hiding LRAS using threshold ElGamal opening, consistency proofs, and public pair verification. We further formalize the signing-layer interface and security goals and analyze signer anonymity, scoped linkability, witness extractability, non-frameability, and pair-consistent opening soundness. A reproducible Python artifact provides reference modules, attack-oriented sanity tests, and operation-count benchmarks. The results show the expected linear scaling with ring size and isolate the accountability overhead introduced by threshold opening and transcript binding.
## 2026/1343
* Title: BiSON: Billion-Scale Oblivious Nearest-Neighbor Search in Milliseconds * Authors: Sankha Das, Rohan Ravi, Nishanth Chandran, Divya Gupta
* [Permalink](https://eprint.iacr.org/2026/1343)
* [Download](https://eprint.iacr.org/2026/1343.pdf)
### Abstract
Semantic search over vector databases is a fundamental problem in both theory and practice, with large-scale systems relying on approximate nearest-neighbor (ANN) algorithms to retrieve semantically similar results efficiently. Achieving this capability securely while keeping both data and queries hidden remains a major challenge. Existing secure semantic search systems incur high latency and fail to scale to realistic database sizes.
We present $\mathsf{BiSON}$, the first secure nearest-neighbor search protocol capable of supporting billion-scale encrypted vector databases. Even at this scale, $\mathsf{BiSON}$ answers queries in mere milliseconds and maintains search accuracy comparable to state-of-the-art insecure ANN algorithms, demonstrating that secure semantic search can be both private and truly high-performance. Compared to Compass, the prior state-of-the-art system, $\mathsf{BiSON}$ reduces communication up to $28\times$, improves end-to-end latency by up to $23.5\times$, and scales to datasets that are two orders of magnitude larger.
A central contribution of $\mathsf{BiSON}$ is a new disk-compatible Oblivious RAM (ORAM) architecture that enables seamless scaling to billion-point datasets without compromising latency or privacy. Together, these innovations make $\mathsf{BiSON}$ the first practical and scalable solution for secure semantic search at cloud scale.
## 2026/1344
* Title: Public Coefficient Matters: A Practical Differential Fault Attack on ML-DSA and HAETAE
* Authors: WonGeun Shin, SeungHyeon Jeon, Daehyeon Bae, Sujin Park, HeeSeok Kim * [Permalink](https://eprint.iacr.org/2026/1344)
* [Download](https://eprint.iacr.org/2026/1344.pdf)
### Abstract
With the standardization of post-quantum digital signature schemes and their increasing deployment in security critical applications such as firmware authentication and software distribution, implementations are expected to operate in physically accessible and potentially hostile environments. Consequently, considerable effort has been devoted to protecting these schemes against a variety of attacks, including timing sidechannel attacks. However, evaluating their resilience against fault injection attacks remains equally important. Previous differential fault analysis (DFA) attacks on lattice-based signatures have primarily targeted intermediate values during signing and often relied on assumptions regarding rejection sampling or multiple fault injections.
In this work, we demonstrate that the challenge sampling procedure itself constitutes a practical attack surface. Specifically, We present fault attacks against the challenge sampling procedures of deterministic ML-DSA, a NIST-standardized signature scheme, and HAETAE, a KpqC-selected signature scheme, showing that a single faulted signature is sufficient to recover the secret key required for signature forgery. To the best of our knowledge, this is the first fault attack on HAETAE achieving secret-key recovery that enables the generation of valid forged signatures. Our attack model of ML-DSA does not require direct access to faulted challenges. Using only public information, we identify intended fault injections and distinguish them from unintended fault outcomes. We evaluate the method through simulation and practical fault injection, achieving a 100% identification rate for intended faults. We further propose a countermeasure for the identified vulnerability
## 2026/1345
* Title: Double-Structured Genetic Algorithm for Solving the SVP Based on Double Optimization: Using Two Types of Chromosomes
* Authors: Masaharu Fukase
* [Permalink](https://eprint.iacr.org/2026/1345)
* [Download](https://eprint.iacr.org/2026/1345.pdf)
### Abstract
The shortest vector problem (SVP) is central in lattice-based cryptography. In this paper, we focus on one of recent classes of algorithms for solving SVP: genetic algorithms (GAs) for lattice. In this paper, we propose the fastest GA to date for solving the SVP. From a search strategy perspective, our algorithm can be seen as an improved version of Fukase's algorithm. On the other hand, from a structure perspective, our algorithm is more than just an improved version of Fukase's algorithm. It is double-structured consisting of: (i) the inner GA, which inherits the basic structure from FukaserCOs algorithm, and (ii) the outer GA, which optimizes the parameters used in the inner GA. The inner and outer GAs use mutually distinct objective functions. In our algorithm, we use two types of chromosomes and split the criterion for evaluation of chromosomes into two objective functions: the squared Euclidean norm for the inner GA and the evolution velocity of a lattice basis for the outer GA. The latter measures the velocity of the changes of the G-S sum, which is the sum of the squared lengths of the Gram-Schmidt orthogonalized vectors of a lattice basis, and is our novel criterion.
## 2026/1346
* Title: Almost Scriptless Adaptor Signatures from any Signature Scheme
* Authors: Emanuele Giunta, Kristina Host|ikov|i
* [Permalink](https://eprint.iacr.org/2026/1346)
* [Download](https://eprint.iacr.org/2026/1346.pdf)
### Abstract
An adaptor signature (AS) scheme extends a digital signature by tying together message authentication with the exchange of a secret. Such atomic exchange of a secret for a signature has key applications in blockchain protocols, e.g., payment channels, atomic swaps or coin-mixing. To ensure compatibility with the environments, AS schemes should be scriptless -- that is, their signatures should be verifiable using the same procedure used to validate transactions' signatures, without auxiliary logic or scripts.
As shown by Erwig et al. (PKC'21), it is impossible to construct scriptless AS for standard signature schemes with unique signatures. In contrast, Liu et al. (ASIACRYPT'24) demonstrated that dropping the scriptless requirement entirely makes AS construction for any EUF-CMA secure signature scheme straightforward.This raises a fundamental question: must we abandon scriptlessness entirely to construct AS for any signature scheme?
We answer this question in the negative by introducing the notion of almost scriptless AS. Here, the only relaxation is that the signature is applied to an extended message -- specifically, the concatenation of the original message and a random string (i.e., signing $m \| r$ instead of $m$). We argue that this mild extension preserves the core benefits of scriptlessness in blockchain applications.
We present a generic compiler that transforms any functional signature scheme into an AS, almost preserving the signature verification. In turn, show how indistinguishability obfuscation (in the CRS model) or witness encryption (in the ROM) allow turning any signature into a functional signature in a scriptless fashion. Both constructions ultimately yield almost scriptless AS for unique-witness (hard) relations and for any base signature.
## 2026/1347
* Title: Revisiting the Quantum Indifferentiability of Merkle-Damg|Nrd: Proof Limitations and Optimal Consistency
* Authors: Xiaoning Guo, Chun Guo
* [Permalink](https://eprint.iacr.org/2026/1347)
* [Download](https://eprint.iacr.org/2026/1347.pdf)
### Abstract
The quantum indifferentiability of the Merkle-Damg|Nrd (MD) domain extender is a foundational problem in post-quantum cryptography.
Recently, Gorjan et al. identified critical flaws in existing consistency proofs for this construction, invalidating prior security guarantees.
Quantum indifferentiability proofs typically reduce to two oracle-indistinguishability games: the indistinguishability game and the consistency game.
To analyze the systems arising in these games, we formalize and generalize Zhandry's compressed oracle proof technique into a modular quantum game-playing framework for systems constructed from random functions.
On the positive side, we develop an error-propagation technique within our framework to track coherence penalties and bad sampling branches for the consistency game.
This yields a tight consistency bound of $O(q_s^{3/2}/2^{n/2})$, matching the optimal complexity of generic quantum collision attacks.
Benefiting from the same formalization, we also identify a fundamental obstruction in the indistinguishability game---a gap also present in Zhandry's original proof.
Specifically, under sequential adaptive queries, the simulated quantum state inevitably leaks into the ``bad database'' subspace and yields a lower bound on the corresponding oracle deviation.
This clarifies why completing the full quantum indifferentiability proof requires additional ideas.
## 2026/1348
* Title: On Canonical Liftings, Group Actions, and (Linkable) Ring Signatures
* Authors: Alessandro Budroni, Giuseppe D'Alconzo, Leonardo Errati, Edoardo Persichetti
* [Permalink](https://eprint.iacr.org/2026/1348)
* [Download](https://eprint.iacr.org/2026/1348.pdf)
### Abstract
We introduce the notion of canonical lifting for group actions. This generalises existing techniques for reducing the size of group-action-based signatures, such as the canonical forms used in the LESS signature scheme. Building on this framework, we construct a ring signature scheme and extend it to a linkable variant.
Our approach avoids the key-reuse mechanism for linkability of the framework by Beullens, Katsumata, and Pintore (ASIACRYPT'20), which was shown to be insecure for group actions arising from linear code equivalence (ASIACRYPT'24) and lattice isomorphism (CiC'25). The resulting signatures have size logarithmic in the ring size. We provide security proofs at the level of the abstract canonical-lifting framework, which are then inherited by concrete instantiations satisfying the required assumptions. Finally, we instantiate our approach using the linear code equivalence group action, obtaining a ring signature scheme, $\mathsf{CERES}$, and a linkable ring signature scheme, $\mathsf{CELERES}$. Both schemes achieve signature sizes that compare favourably with the state of the art, and our AVX2-optimised C implementation supports their practical applicability.
## 2026/1349
* Title: Sharper and Closed-Form Attacks on $\mathsf{SIS}$ When Modulus Is Small
* Authors: Navid Abapour
* [Permalink](https://eprint.iacr.org/2026/1349)
* [Download](https://eprint.iacr.org/2026/1349.pdf)
### Abstract
The Large Norm attacks of Ducas-Espitau-Postlethwaite (CRYPTO 2023) on the $\mathsf{ISIS}$ problem have shown that small values of $q$ can be used to recover short solutions. This was applied to Falcon and Mitaka. Two issues are left, however. First, the cost model of the attack oversimplifies the BDGL sieve; it does not account for how long vectors will be distributed and treats two dependent probabilistic events as if they were independent, which results in an overestimation of the attack cost. Secondly, the analysis only deals with the $\ell_2$ norm and has not yet been extended to $\mathsf{ISIS}^\infty$, which underlies Dilithium-type systems.

This work addresses both issues. First, we extend the cost model of the Large Norm attack by including the principal sieve length distribution into our estimation of success probabilities. In addition, we use a joint probability rather than an approximate factor where possible. Since all other parts of the original $\theta$ convolution framework are reused, the extension is relatively minor. We reduce the attack cost of Large Norm on Falcon-256 by a $\approx\!11\times$ cheaper model, and successfully forge a Mitaka-512 signature in $\approx\!4.5$ seconds at a higher success rate. We additionally introduce a closed-form $\ell_\infty$ variant as a Z-shape attack against Dilithium-type $\mathsf{ISIS}^{\infty}$ at small-to-moderate modulus, which succeeds in $\le\!1.6$ seconds across three presets.
## 2026/1350
* Title: Refined Evaluation Methods of Decryption Failure Rate in Lattice-Based Public-Key Encryption with Message Encoding
* Authors: Guoqing Zhou, Lin Wang, Yue Cao, Baosheng Huang, Sen Hou, Dawu Gu
* [Permalink](https://eprint.iacr.org/2026/1350)
* [Download](https://eprint.iacr.org/2026/1350.pdf)
### Abstract
Lattice-based cryptography is one of the most promising candidates for post-quantum cryptography. Decryption Failure Rate (DFR) is a critical metric for the correctness and security of lattice-based public-key encryption (PKE) schemes. At present, most DFR evaluation methods for lattice-based PKE with message encoding rely on oversimplified assumptions, rough approximations, and fail to fully exploit the geometric structure of special encoding lattices, resulting in loose or inaccurate bounds.

To address these limitations, this paper proposes a refined DFR evaluation framework for lattice-based PKE with message encoding, focusing on two mainstream decoding paradigms: Maximum Likelihood Decoding (MLD) and Bounded Distance Decoding (BDD). For MLD-based schemes, we precisely characterize the minimal vectors of Barnes-Wall (BW) lattices and derive tighter union bounds by leveraging the encoding lattice structure. For BDD-based schemes, we introduce a noncentral chi-squared distribution based method to model mixed noise composed of Gaussian and discrete components, avoiding the inaccuracy of conventional pure Gaussian approximations. Furthermore, we extend the framework to algebraic-lattice-based PKE by analyzing the variance and correlation of polynomial product coefficients, and propose a weighted chi-squared distribution with saddlepoint approximation to handle correlated coefficients.

We validate the proposed methods on representative lattice-based PKEs including CNTR, \scloud, and CNTR-Prime, resulting in the DFR upper bound approximate 15 bits decreasing for CNTR, 1 bit decreasing for \scloud, and at least 84 bits increasing for CNTR-Prime. The experimental results show that our refined analysis yields significantly tighter and more accurate DFR bounds compared with traditional approaches, providing a reliable theoretical basis for parameter selection and security certification of practical lattice-based cryptosystems.
## 2026/1351
* Title: Hardware Private Cubic Circuits
* Authors: Frederik Reiter, Amir Moradi
* [Permalink](https://eprint.iacr.org/2026/1351)
* [Download](https://eprint.iacr.org/2026/1351.pdf)
### Abstract
Cryptographic hardware implementations often leak secret information through side channels. This can allow attackers to learn secret data, such as a cryptographic key, without any vulnerability in the cryptographic algorithm itself. A popular countermeasure to such attacks is masking, which ensures that processed data is independent of the secrets by splitting them into multiple independent shares, often at the cost of significant overhead in terms of required area, latency, and randomness.
The composable PINI notion in the glitch-extended probing model ensures some degree of security against such side-channel analysis attacks, and guarantees that the circuit may be arbitrarily composed with other PINI circuits while maintaining the same security level.
This allows for the secure implementation of arbitrary circuits using trivial composition, replacing elementary gates with "gadgets" realizing the same functionality in a PINI-secure manner.
Up to now, PINI gadgets at arbitrary security order are limited to quadratic functions, i.e., 2-input gates, with the best known as HPC3.X realizing a 2-input multiplier in one clock cycle.
In this work, we present HPCC, the first low-latency 3-input multiplication gadget for arbitrary fields that maintains a constant latency of one cycle, independent of the number of shares. HPCC additionally allows for the computation of any number of multiplications in a single cycle with relatively little overhead when two of the three operands are identical. When instantiated with two shares and for $\mathbb{F}_2$, HPCC halves the previous record for lowest number of fresh masks required at comparable area cost.
With more shares, HPCC is the only single-cycle gadget realizing 3-input multiplications in arbitrary fields. We leverage HPCC to implement the first composable AES S-Box with two cycles of latency with an arbitrary number of shares. This S-Box design significantly outperforms the previous record in terms of area and randomness when instantiated with three shares and stands as the only two-cycle solution for more shares.
## 2026/1352
* Title: Dead ManrCOs Switch Cryptography
* Authors: Shalini Banerjee, Andrey Bozhko, Raphael Heitjohann, Andy Rupp
* [Permalink](https://eprint.iacr.org/2026/1352)
* [Download](https://eprint.iacr.org/2026/1352.pdf)
### Abstract
We initiate the formal study of "dead man switch cryptography" rCo the problem of cryptographically enforcing the fate of a long-lived secret upon the death of its sole keeper rCo either by releasing it exclusively to designated nominees or by provably destroying it. Despite the natural practical demand, no prior work formalizes this primitive.
We identify Dead Man's Switch (DMS) as a standalone cryptographic primitive with two modes: release and delete, capturing these dual functionalities. Our abstraction isolates the core conceptual properties of this primitive, and gives its first rigorous treatment in the UC framework. To realize the notion, we introduce Dealer-Controlled Evolving-Committee Proactive Secret Sharing (DC-EPSS), an extension of the Evolving-Committee Proactive Secret Sharing by Benhamouda et al. (TCC '20). We provide the UC formalization of DC-EPSS and instantiate it generically using the nested YOSO framework of Abraham, Chouatt, Damgard, Gilad, Stern, and Yakoubov.
Building on DC-EPSS, we realize DMS-release by coupling it with a multi-recipient authorized recovery mechanism based on a PKI infrastructure, a multi-recipient PKE, a key committing SKE, and NIZK proof systems, while DMS-delete directly follows from DC-EPSS instantiated in the delete mode. We prove the security of both constructions in the UC framework under standard assumptions.
## 2026/1353
* Title: 3PaaS: Privacy-Preserving Post-Compromise Security as a Service
* Authors: Cas Cremers, Abhinav Nakarmi, Aleksi Peltonen, Eyal Ronen
* [Permalink](https://eprint.iacr.org/2026/1353)
* [Download](https://eprint.iacr.org/2026/1353.pdf)
### Abstract
Post-Compromise Security (PCS) expresses that even after a party has been compromised, it may be able to recover (or "heal") security afterwards. PCS has been extensively studied, and many end-to-end secure messaging applications include mechanisms, such as the double ratchet, to achieve it.
However, current approaches only work partially, and their healing effects are extremely limited. For example, recent work showed that due to real-world constraints such as resilience against state loss, even highly secure messengers such as Signal may not achieve it in practice. Moreover, since healing is session-specific, healing effects do not carry over to newly spawned sessions, different groups, or different services that use the same identity.
In this work, we tackle these issues by designing the first protocol that can provide PCS as a Service for identities through a third party. The major challenge is privacy: achieving PCS requires regular updates among participants, and involving a third party can lead to significant privacy concerns. Moreover, the type of update that PCS requires (updating a user's secret, but only once) seems to require servers to verify the users' identities in a way that contradicts the unlinkability required for privacy: the server should not learn anything about the users' activities.
We develop the 3PaaS protocol, including the first efficient zero-knowledge proofs for blind signatures, to achieve our goals, and even allow for revocation, without revealing the identity to the server. We formally analyze our protocol for high assurance, provide an implementation of our novel ZK building blocks, and show how our protocol could be used with a messaging application.
## 2026/1354
* Title: Adaptive Quantum-Resistant Hybrid Encryption Framework for Secure IoMT Edge Data Sharing
* Authors: Zahra Seyedi, Stefan Rass, Shahzad Ahmad, Farhad Rahmati
* [Permalink](https://eprint.iacr.org/2026/1354)
* [Download](https://eprint.iacr.org/2026/1354.pdf)
### Abstract
The Internet of Medical Things (IoMT) is revolutionizing healthcare through real-time monitoring and personalized care, yet existing security solutions for resource-constrained IoMT devices often compromise between robust protection and computational efficiency. Additionally, various IoMT systems utilize different sets of encryption schemes, ranging from classical to post-quantum algorithms, tailored to their computational resources, operational constraints, and specific privacy challenges. This diversity highlights an urgent need for an adaptive and efficient, quantum-resistant security protocol applicable to these systems. We propose the Privacy-Preserving Hybrid Data Sharing ($P^2HDS$) framework, which integrates multiple classical and post-quantum encryption schemes to achieve strong security with enhanced efficiency. $P^2HDS$ formalizes a generalized hybrid encryption protocol that enables adaptive configuration based on security requirements and computational constraints. We employ game-theoretic analysis to model interactions between data owners and adversaries, determining the optimal combination of encryption schemes for data outsourcing to mitigate adversarial threats. Rigorous security analysis proves that $P^2HDS$ achieves indistinguishability under chosen-plaintext attack (IND-CPA) security in the random oracle model, provided at least one constituent scheme is IND-CPA-secure. Experimental results demonstrate that $P^2HDS$ delivers performance approximating the average of its constituent schemes while maintaining security comparable to the most secure component, making it a scalable, quantum-resistant, and adaptive solution for privacy-preserving IoMT edge applications.
## 2026/1355
* Title: Compressing Correlations via Secret Replication: PCFs from Symmetric Cryptography
* Authors: Yuval Ishai, Hugo Krawczyk, Tal Rabin
* [Permalink](https://eprint.iacr.org/2026/1355)
* [Download](https://eprint.iacr.org/2026/1355.pdf)
### Abstract
We revisit the question of securely compressing multiparty correlations using only symmetric cryptography. A *linear correlation* ${\cal C}$, defined by a linear subspace $C\subseteq \mathbb F^n$, samples a secret random ${\bf c}\in C$ and assigns to each party a fixed subset of the entries of ${\bf c}$. Gilboa and Ishai (Crypto 1999) and Cramer, Damg|Nrd and Ishai (TCC 2005) provide a general technique for securely compressing many independent samples from $\cal C$ by replicating independent keys of a pseudorandom function (PRF) among the parties. This implies a *pseudorandom correlation function* (PCF) for $\cal C$ from any PRF, where the PCF key size scales with the number of minimal-support codewords in $C$.
We observe that the above generalizes to other types of useful target correlations ${\cal C}_T$ by using a *secret* replication pattern obtained via a random secret assignment of parties in $\cal C$ to parties in ${\cal C}_T$.
We present several corollaries of this general blueprint. These include a re-derivation of two-party PCF constructions for VOLE and subfield-VOLE over small domains (Roy, Crypto 2022) as well as new multiparty PCFs for small-domain VOLE-style correlations, including scalar-vector multiplication triples and their authenticated variants. Finally, we discuss applications to secure computation.
## 2026/1356
* Title: Spain: Succinct proofs for numerical computations
* Authors: Zachary DeStefano, Noah Golub, Zile Huang, Julius Zhang, Sam Frank, Michael Walfish
* [Permalink](https://eprint.iacr.org/2026/1356)
* [Download](https://eprint.iacr.org/2026/1356.pdf)
### Abstract
In a succinct proof protocol, a verifier gets assurance that an untrusted prover executed an agreed computation, without requiring the verifier to re-execute the computation itself. In little more than a decade, this area has undergone a remarkable transformation from theory to implemented systems. This activity is extremely exciting. But there is a catch. To apply succinct proofs, one needs to translate one's computation to a set of equations, or constraints. The required translation has so far completely blocked systematic support for numerical computations, namely those for which the bulk of the computation uses approximations of real numbers. This paper fills that void with the design, implementation, and evaluation of a system called Spain. The starting insight of Spain is that since numerical computations inherently have approximation error, the constraint formalism should likewise allow for approximate satisfiability. Based on this insight, Spain introduces a new proof protocol and new ways to translate computations to constraints. Spain's implementation improves over natural baselines by multiple orders of magnitude.
--- Synchronet 3.22a-Linux NewsLink 1.2